Privacy Policy

• Account information. When you sign in, we collect your email address and authentication credentials.
• Workspace data. Inventory items, products, SKUs, locations, sales and order history, purchase orders, supplier information, customer information, packing and fulfillment records, accounting and transaction data, and other operational data that you or your organization enter into, upload to, synchronize with, or otherwise make available to the App.
• Support communications. Messages, screenshots, or attachments you send to our support team.

• Device information. Device model, operating system version, unique device identifiers, app version, and language settings.
• Usage data. Screens viewed, features used, crash logs, and performance metrics, used to diagnose problems and improve the App.
• Log data. IP address, access times, and request metadata when the App communicates with our servers.

The App uses your device's camera only to scan barcodes and QR codes for inventory operations. Camera frames are processed on-device in real time and are not stored, recorded, or transmitted to our servers or any third party. The decoded barcode value (a short string of text) is sent to our servers only when needed to look up or update inventory.

If you connect a hardware barcode scanner via Bluetooth or USB, the App receives the decoded text values from that device. We do not access any other Bluetooth or peripheral data.

• We do not collect your contacts, photos, microphone audio, precise location, or biometric data.
• We do not sell personal information. Our public website uses analytics and marketing technologies as described in Section 14. Shopify protected customer data and authenticated customer workspace data are not provided to these marketing vendors or used for advertising.

We use workspace data, including historical sales, order, inventory, purchasing, product, supplier, and related operational data, to provide demand forecasts, inventory analytics and planning, replenishment and purchasing recommendations, recommended order quantities, draft purchase order generation, alerts, reports, and other Service features for the workspace associated with that data. These features may use automated, statistical, algorithmic, machine-learning, or artificial-intelligence technologies.

Processed Shopify webhook payload content is normally removed within 7 days, and completed webhook records are removed within 30 days. Failed or pending webhook records may be retained for up to 90 days so they can be retried and investigated.

When Shopify sends a customer deletion request, we delete the customer's Shopify linkage, remove linked contact and address records, erase stored export snapshots, and anonymize identity fields in business records that must be retained. When Shopify sends a shop deletion request following uninstall, we delete stored Shopify credentials, raw Shopify payloads, location mappings, and Shopify linkage records.

If a merchant independently activates and uses Spark Inventory outside Shopify, we may retain non-personal operational or accounting records as necessary to provide the merchant's Spark service, meet legal obligations, or preserve legitimate business records. Personal identity, contact, and address information associated with deleted Shopify data is removed or anonymized. Accounts created through the Shopify App Store that were never activated or used are anonymized.

We retain pseudonymous deletion receipts for up to seven years for compliance auditing. These receipts contain identifiers such as a hashed shop reference and timestamps, but not the shop domain or raw Shopify payload.

Shopify data is encrypted in transit and at rest, including application-level protection of Shopify access and refresh tokens. Access is restricted to authorized personnel and subject to logging and access controls.

Merchants can disconnect Shopify from Spark Inventory or request deletion by contacting support@sparkinventory.com. Customers whose information originated from a Shopify merchant can also exercise their privacy rights by contacting that merchant.

The App includes an AI chat assistant. When you interact with it, your messages and relevant workspace context are sent to our AI processing provider to generate a response. We do not use your data to train third-party foundation models. You can avoid this in-app assistant by not opening the chat tab.

You may choose to connect an external AI assistant, such as ChatGPT or Claude, to your Spark workspace. Within the access you authorize, the assistant can request information and supported actions through Spark's connector. Depending on the tools used and enabled features, returned information can include products and SKUs, warehouse stock, demand and replenishment information, customer and supplier business records, purchase and sales orders, and workspace setup or integration status. Business records may include personal information, such as contact names, contact details, and addresses, as well as tax identifiers or supplier payment details when returned by the requested tool.

Read-only connections can retrieve permitted information. Connections with write access can also perform supported changes within Spark's authorization rules. Some workflows separate preview from commitment. A connection does not authorize access to another customer's workspace.

Information returned to an external assistant is processed by that assistant's provider under its applicable terms and your account's privacy settings. The statement about Spark's use of data for model training in Section 5.1 does not describe an external provider's independent practices. Spark's handling of workspace and account data remains subject to this Privacy Policy, including its retention and deletion provisions.

You can revoke Spark-side access in Spark's AI Assistants settings and remove the connection in the assistant. Revoking access does not necessarily delete information already included in an assistant conversation; use that provider's conversation and data controls for those copies. For access or privacy requests, contact support@sparkinventory.com. Complete sign-in and verification in Spark's browser pages, and do not send passwords or verification codes in chat.

If you set up a forwarding rule in your email provider, copies of the messages you forward are delivered to a Spark address through our email delivery provider (Mailgun). Spark then checks each message as described in section 6.4. Spark only sees the messages your forwarding rule sends to it.

What we access. When you connect a Gmail account, we request the gmail.send scope (shown on Google's consent screen as "Send email on your behalf"), plus your email address so we know which account you connected. This scope lets Spark send email; it does not let Spark read your mail.

How we use it. We send a message through Gmail only when you click "Send" or "Approve" on a reply or follow-up you have reviewed in Spark Inventory. We do not send autonomous, bulk, or marketing email through this integration. For each message sent, we keep Gmail's message and thread identifiers as an audit record.

What we access. If you turn on "Order capture from your inbox" for a connected Gmail account, we also request the gmail.readonly scope (shown on Google's consent screen as "View your email messages and settings"). We request it only when you turn this feature on, never when you first connect Gmail. The scope is read only: Spark never sends, changes, labels, moves, or deletes messages with it.

How we use it. While the feature is on, Spark checks your Gmail inbox for new messages every few minutes. It reads each new message's sender and subject first. Only messages that look like they are about sales orders, purchase orders, invoices, quotes, or shipments are opened and checked as described in section 6.4. When a message is about an order, Spark creates or updates that order in your workspace and notifies you of anything you need to act on. When you first turn the feature on, Spark also checks messages from the previous 14 days so that orders already in your inbox are picked up. Spark does not read your sent mail, drafts, spam, or trash.

What we store. For messages Spark identifies as related to an order, we store the message content with that order so you can see where each change came from, for up to 90 days as described in section 6.5. For all other messages, we keep only an internal message identifier and the date received, so the same message is not processed twice; we do not keep their sender, subject, or content.

Turning it off. You can turn the feature off at any time on the Email accounts page. Spark stops reading your inbox immediately.

To decide whether a message is about an order and to extract the order details (such as items, quantities, prices, and dates), Spark sends the message's sender, subject, and text to our AI processing provider, OpenAI. OpenAI processes this content under API terms that prohibit using it to train its models. OpenAI may keep API data for a limited period (up to 30 days) to monitor for abuse before deleting it. Spark may also draft a reply for you to review; a draft is never sent until you approve it.

OAuth tokens and stored email content are encrypted in transit and at rest. You can disconnect a mailbox at any time from the Email accounts page (Profile → Email accounts). When you disconnect a Gmail account, we revoke Spark Inventory's access with Google and delete the stored tokens immediately, and inbox sync stops. You can also revoke access from your Google Account at myaccount.google.com/permissions.

Stored email content (sender, recipients, subject, and message text) is removed automatically 90 days after the message was received, whether or not the mailbox is still connected. After that, we keep only the message's internal identifier, the date it was received, how Spark classified it, and its link to the related order, customer, or supplier. Orders and notes you create or approve are part of your workspace data and are kept as described in Section 8. To have stored email content deleted sooner, contact support@sparkinventory.com.

Spark Inventory's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy.

• We use Google user data only to provide and improve the user-facing email features described in this section.
• We do not sell Google user data, and we do not transfer it to advertising platforms, data brokers, or information resellers.
• We do not use Google user data for advertising, including retargeting, personalized, or interest-based advertising.
• We do not use Google user data to determine credit-worthiness or for lending purposes.
• We do not use Google user data to develop, train, or improve generalized artificial intelligence or machine learning models.
• We transfer Google user data to third parties only as needed to provide these features (our AI processing provider, OpenAI, as described in section 6.4), to comply with law, or as part of a merger or acquisition with your prior consent.
• No one at Spark Inventory reads your Google user data unless you give us explicit permission to view specific messages (for example, for support), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

When you enable SMS notifications or turn on Texting with Spark from your Spark Inventory account settings, we collect and store:

• The mobile phone number you provide
• The date and time you opted in
• The IP address and user-agent string of the device used to opt in
• The exact version identifier of the consent statement you agreed to
• Your per-notification-type preferences (which message categories you've enabled or disabled)

We also retain a per-message delivery log (timestamp, carrier-reported status, and provider message identifier) so that we can troubleshoot delivery problems and honor opt-out requests reliably.

If you use Texting with Spark, we also store the texts you send to your business's Spark number and Spark's replies, as part of your assistant conversation history.

Mobile phone numbers collected through SMS opt-in are used solely to deliver the program you enrolled in: the operational notifications you have subscribed to (inventory alerts, order updates, and similar operational events in your Spark account) or, for Texting with Spark, alerts, summaries, and replies to the texts you send; and to support opt-out (STOP) and help (HELP) requests. The text of messages you send to Spark is processed by our AI processing provider to generate a reply, as described in Section 5; your mobile phone number is not used for that purpose. We do not use SMS opt-in data for marketing or promotional outreach. We do not send marketing SMS.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. No mobile information will be sold or shared with third parties for promotional or marketing purposes. Text messaging opt-in data and consent will not be shared with any third parties. We do not rent, sell, or otherwise make available any mobile phone numbers, opt-in records, or related data to third parties for advertising or marketing. The sharing described elsewhere in this Privacy Policy, including in Section 14, excludes mobile phone numbers, text messaging opt-in data, and consent.

We share mobile phone numbers only with the SMS service provider that delivers the messages on our behalf (currently Twilio), strictly for the purpose of sending the message and receiving delivery status confirmations. Our SMS service provider is bound by their own contractual confidentiality and data-handling obligations.

You can revoke your consent to receive SMS at any time by either:

• Replying STOP to any Spark Inventory SMS: your opt-out is recorded immediately, and you will not receive further messages.
• Visiting Profile → SMS notifications inside your Spark Inventory account and clicking "Turn off SMS".

You can also leave Texting with Spark on its own from Profile → SMS.

Replying HELP to any Spark Inventory SMS will return a brief description of the program and our support contact (support@sparkinventory.com).

For full details about the SMS programs, including the verbatim consent statements, frequency expectations, and sample message content, see app.sparkinventory.com/sms-program and sparkinventory.com/sms-program.

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising.

If you are in the EEA, UK, or Switzerland, our legal bases for processing are: performance of a contract (providing the Service), legitimate interests (improving and securing the Service), and consent (where applicable). Data may be transferred to and processed in countries outside your jurisdiction; where required, we use Standard Contractual Clauses or equivalent safeguards.

These are needed for the website and App to work, so they are not controlled by the consent banner:

• Your consent choice. CookieYes stores your cookie choices in a cookie named cookieyes-consent so we can respect them on both sites.
• Signing in. The App does not use cookies to keep you signed in. When you sign in, the App keeps your sign-in token and basic account and workspace details (such as your name, email address, and the workspace you selected) in your browser's local storage. They are removed when you sign out.
• Your settings. The App keeps display preferences in local storage, such as whether the sidebar or assistant panel is open, list views and sorting, and tips you have dismissed. It uses session storage for short-lived steps, such as returning you to the page you were on after you sign in. Our website uses session storage to record a booked demo only once per visit and to keep campaign parameters (such as utm_source) while you move between pages.
• Payments. When you add a payment method, the card form is provided by our payment processor and may set its own cookies for security and fraud prevention.

We use PostHog on our public website and web application to understand usage and diagnose problems. If you accept analytics cookies, PostHog stores an analytics identifier and first-visit campaign details (such as the ad campaign or referring website that brought you to us) in a cookie shared by sparkinventory.com and app.sparkinventory.com and in local storage, and we can connect usage to your Spark account and workspace identifiers and record masked interactions on selected pages. Text, input values and element attributes are masked; payment forms, embedded frames and sensitive account or billing routes are excluded from replay. Replay console logs and network payloads are not collected.

Until you make a cookie choice, and if you reject optional analytics cookies, we use cookieless usage measurement without account or workspace identifiers or session replay. PostHog processes the request IP address and user agent to calculate a hash with a daily changing salt, rather than storing an analytics identifier in your browser. These measurements can include campaign details from the page address, such as UTM tags or a Google Ads click ID.

If you accept analytics cookies on our public website, we also load PHAS3, an attribution service that measures which marketing channels lead to visits, sign-ups, and booked demos. It does not load if you reject analytics cookies.

• Google Ads. Our website and App include the Google tag to measure when an ad click leads to a sign-up or booked demo. We use Google Consent Mode, so Google's advertising storage stays denied until you accept advertising cookies (and its analytics storage until you accept analytics cookies), and Google does not set advertising cookies before then. Until you accept, Google may receive cookieless signals (such as the page, the time, and whether consent was given) that do not use advertising cookies.
• LinkedIn Insight Tag. On our website and App, the LinkedIn Insight Tag loads only after you accept advertising cookies. It lets us measure the results of our LinkedIn advertising and may set LinkedIn cookies.

• Scheduling. When you choose to book a call, our website loads Calendly's scheduling window. Calendly may set its own cookies under its privacy policy.
• Product updates. Inside the App, the "What's new" panel is provided by Headway and may use cookies or local storage to remember which updates you have already seen.

You can change your choice at any time using Privacy preferences in the website footer or on your Profile page in the App. Advertising cookies are a separate preference from analytics cookies. You can also delete cookies and site data in your browser settings; clearing the App's local storage signs you out.

These website marketing technologies are not applied to Shopify protected customer data, data stored inside authenticated Spark Inventory workspaces, Google user data, or mobile phone numbers and SMS opt-in data. No mobile information is shared with these partners or vendors.